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DETAILED ACTION 



1. 



Claims 1-35 have been examined. 



Claim Rejections - 35 USC § 112 

2. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

3. Claim 15 is rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 

4. Claim 15 recites the limitation "the control object" in line2 of claim 15. There is 
insufficient antecedent basis for this limitation in the claim. 



5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 



Claim Rejections - 35 USC § 102 
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6. Claims 1, 2, 5, 7-10, 17, 18, and 20-23 are rejected under 35 U.S.C. 102(e) as being 
clearly anticipated by Balasubramaniam et al. U.S. Pat. No. 6499109 (hereinafter Bal). 

7. As per claim 1, Bal discloses a method, comprising: associating a digital signature with a 
web page (Bal: column 7 lines 32-38); and delivering the web page to an electronic device 
capable of authenticating the digital signature and executing at least a portion of the web page 
after the digital signature is authenticated (Bal: column 2 line 43 - column 3 line 19). 

8. As per claim 2, Bal discloses the method as recited in claim 1. Bal further discloses 
wherein the associating further comprises attaching the digital signature to the web page (Bal: 
column 7 lines 32-36). 

9. As per claim 5, Bal discloses the method as recited in claim 1. Bal further discloses 
wherein the web page contains script that, when executed, invokes executable code that is 
executed on the electronic device executing the web page (Bal: column 2 lines 43-65). 

10. As per claim 7, Bal discloses a method, comprising: receiving a web page from a server, 
the web page containing executable script that, when executed, invokes a control object (Bal: 
column 7 lines 26-51), the web page having a segment that uniquely identifies a source of the 
web page (Bal: column 7 lines 26-51); authenticating the source of the web page (Bal: column 7 
lines 26-5 1); and displaying the web page and invoking the control object if the web page is 
authenticated (Bal: column 7 lines 26-51). 
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11. As per claim 8, Bal discloses the method as recited in claim 7. Bal further discloses 
determining if the source of the web page is authorized to invoke the control object (Bal: column 
7 lines 32-36); and displaying the web page only if the source of the web page is authorized to 
invoke the control object (Bal: column 7 lines 26-51). 

12. As per claim 9. Bal discloses the method as recited in claim 7. Bal further discloses 
wherein the authenticating further comprises authenticating the source of the web page to 
identify the source of the web page (Bal: column 7 lines 26-51). 

13. As per claim 10, Bal discloses the method as recited in claim 7. Bal further discloses 
designating one or more authorized sources from which a web page that invokes a control object 
may be received; and executing script contained in the web page only if authenticating the source 
of the web page indicates that the web page was received from an authorized source (Bal: 
column 8 lines 32-63). 

14. As per claim 17, Bal discloses a system, comprising: a web browser configured to access 
a web page having a digital signature (Bal: column 1 line 19 - column 3 line 19); a processor 
configured to execute script contained in the web page (Bal: column 1 line 19 - column 3 line 
19); an executable control object that may be invoked by the script in the web page and is 
executable on the processor (Bal: column 1 line 19 - column 3 line 19); a confirmation module 
configured to authenticate the digital signature (Bal: column 1 line 19 - column 3 line 19); and 
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wherein the confirmation module is called when the control object is invoked by the script (Bal: 
column 7 lines 26-51), the control object executing only if the confirmation module authenticates 
the digital signature (Bal: column 7 lines 26-51). 

15. As per claim 18, Bal discloses the system as recited in claim 17. Bal further discloses 
wherein the confirmation module is called by the control object (Bal: column 7 lines 26-51). 

16. As per claim 20, Bal discloses the system as recited in claim 17. Bal further discloses 
wherein the confirmation module is included in the web browser (Bal: column 7 lines 26-51 and 
column 3 lines 7-19). 

17. As per claim 21, Bal discloses the system as recited in claim 17. Bal further discloses 
wherein the confirmation module is further configured to determine if the web page comes from 
a source that is authorized to invoke the control object and the control object is invoked only if 
the source of the web page is authorized to invoke the control object (Bal: column 7 lines 26-51). 



18. As per claim 22, the system as recited in claim 17, wherein the confirmation module is 
called by the web page prior to the web page invoking the control object (Bal: column 7 lines 26- 
51). 
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19. As per claim 23, Bal discloses the system as recited in claim 17, Bal further discloses 
wherein the digital signature module is not invoked if the web page does not have a digital 
signature (Bal: column 7 lines 29-52). 

20. Claims 1 1 and 14 are rejected under 35 U.S. C. 102(e) as being clearly anticipated by 
Yoshiura et al. U.S. Pat. No. 6499105 (hereinafter Yoshiura). 

21. As per claim 11, Yoshiura discloses a system, comprising: a page generator to generate a 
web page (Yoshiura: column 30 lines 5-63); a digital signature module configured to derive a 
digital signature from the web page and attach the digital signature to the web page (Yoshiura: 
column 30 lines 5-63); and a page delivery module to deliver the signed web page to an 
electronic device (Yoshiura: column 30 lines 5-63). 

22. As per claim 14, Yoshiura discloses the system as recited in claim 1 1 . Yoshiura further 
comprising: a confirmation module configured to authenticate the digital signature (Yoshiura: 
column 30 lines 36 - column 31 lines 19). 

Claim Rejections - 35 USC § 103 

23. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 
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24. Claim 3 is rejected under 35 U.S.C. 103(a) as being unpatentable over Bal in view of 
Yoshiura and further in view of Liu U.S. Pat. No. 6058482 (hereinafter Liu). 

25. As per claim 3, Bal discloses the method as recited in claim 1 . Bal does not explicitly 
discloses the method comprising: determining if the web page includes code to invoke a control 
object; and deriving the digital signature and associating the digital signature with the web page 
only if the web page includes code to invoke a control object. However, Yoshiura discloses 
determining if a mark with digital signature should be derived and attach to a web page 
(Yoshiura: column 30 lines 37-55). It would have been obvious to one having ordinary skill in 
the art to combine the teachings of Yoshiura within the system of Bal because it increases 
security by determining whether the sender should get the digital signature. Bal as modified does 
not explicitly determining if the web page includes code to invoke a control object. However, 
Liu discloses that limitation (Liu: column 8 lines 1-50). It would have been obvious to one 
having ordinary skill in the art to combine the teachings of Liu within the combination of Bal- 
Yoshiura because it increases efficiency by avoiding unnecessary further process. 

26. Claim 4 is rejected under 35 U.S.C. 103(a) as being unpatentable over Bal in view of 
Yoshiura. 

27. As per claim 4, Bal as modified discloses the method as recited in claim 1. Bal as 
modified further discloses wherein the web page includes a confirmation module that is used by 
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the electronic device to authenticate the digital signature (Yoshiura: column 30 lines 37-55: the 
mark). 

28. Claim 6 is rejected under 35 U.S.C. 103(a) as being unpatentable over Bal in view of 
Myer et al. U.S. Pat. No. 6615088 (hereinafter Myer). 

29. As per claim 6, Bal discloses the method as recited in claim 1. Bal does not explicitly 
disclose wherein the web page is generated in an active server page (ASP) environment. 
However, Myer discloses that limitation (Myer: column 3 lines 47-54). It would have been 
obvious to one having ordinary skill in the art to combine the teachings of Myers within the 
system of Bal because ASP makes web pages more dynamic and interactive. 

30. Claim 12 is rejected under 35 U.S.C. 103(a) as being unpatentable over Yoshiura in view 
of Liu. 

31. As per claim 12, Yoshiura discloses the system as recited in claim 1 1 . Yoshiura further 
discloses determining if a mark with digital signature should be derived and attach to a web page 
(Yoshiura: column 30 lines 37-55). Yoshiura does not explicitly discloses the digital signature 
module being further configured to determine whether the web page contains script to invoke 
executable code, and to apply a digital signature to the web page only if the web page contains 
script to invoke executable code. However, Liu discloses further process is done after 
determining if the web page contains script to invoke executable code (Liu: column 8 lines 1-50). 
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It would have been obvious to one having ordinary skill in the art to combine the teachings of 
Liu within the system of Yoshiura because it increases efficiency by avoiding unnecessary 
further process. 

32. Claims 13 and 16 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Yoshiura in view of Bal. 

33. As per claim 13, Yoshiura discloses the system as recited in claim 11. Yoshiura does not 
explicitly disclose the system further comprising: a control object in the web page; script in the 
web page that invokes the control object; and wherein the control object includes executable 
instructions that are executable on the electronic device that receives the web page. However, 
Bal discloses these limitation (Bal: column 2 lines 30-65). It is well known in the art to have web 
pages disclose the above limitation to generate dynamic and interactive web page. Therefore, it 
would have been obvious to one having ordinary skill in the art to combine the teachings of Bal 
within the system of Yoshiura. 

34. As per claim 16, Yoshiura discloses the system as recited in claim 14. Yoshiura further 
discloses the confirmation module is included in the user terminal. Yoshiura does not explicitly 
discloses wherein the confirmation module is included in a browser of the electronic device. 
However, Bal discloses that limitation (Bal: column 7 lines 26-51). It would have been obvious 
to one having ordinary skill in the art to combine the teachings of Bal within the system of 
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Yoshiura because it is well known in the art for browsers to directly verify security information 
on the web. 

35. Claim 35 is rejected under 35 U.S.C. 103(a) as being unpatentable over Yoshiura in view 
of Bal and further in view of Renaud et al. U.S. Pat. No. 59580521 (hereinafter Renaud). 

36. As per claim 15, Yoshiura discloses the system as recited in claim 14. Yoshiura does not 
explicitly discloses wherein the confirmation module is included in the control object. However, 
Bal discloses that verifying digital signature before executing the control object (Bal: column 7 
lines 37-38). It would have been obvious to one having ordinary skill in the art to interpret the 
mark disclosed by Yoshiura as the digital signature that corresponds to the control software. 
Therefore, it would have been obvious to one having ordinary skill in the art to combine the 
teachings of Bal within the system of Yoshiura because it is well known in the art to authenticate 
digital signature associated with a control software. Yoshiura as modified does not explicitly 
disclose the confirmation module is included in the control object. However, Renaud discloses 
that limitation (Renaud: column 4 lines 15-18). It is well known in the art to use control objects 
to perform security functions. Therefore, it would have been obvious to one having ordinary skill 
in the art to combine the teachings of Renaud within the combination of Yoshiura-Bal. 

37. Claims 19 and 24 are rejected under 35 U.S.C. 103(a) as being unpatentable over Bal in 
view of Renaud. 
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38. As per claim 19, Bal discloses the system as recited in claim 17. Bal does not explicitly 
discloses wherein the confirmation module is included in the control object (Bal: column 7 lines 
26-51). However, Renaud discloses that limitation (Renaud: column 4 lines 15-19). It is well 
known in the art to use control objects to perform security functions. Therefore, it would have 
been obvious to one having ordinary skill in the art to combine the teachings of Renaud within 
the system of Bal. 

39. As per claim 24, Bal discloses a web page contained on a computer-readable medium, 
comprising: computer-executable script that (Bal: column 1 line 19 - column 3 line 19), when 
executed on a computing device, invokes an executable control object on the computing device 
(Bal: column 1 line 19 - column 3 line 19); and a digital signature (Bal: column 1 line 19 - 
column 3 line 19). Bal does not explicitly disclose the digital signature uniquely identifying an 
author of the web page. However, Renaud discloses that limitation (Renaud: column 4 lines 19- 
34). It would have been obvious to one having ordinary skill in the art to combine the teachings 
of Renaud within the system of Bal because it increases security by checking whether the source 
of the page is authentic. 

40. As per claim 26, Bal as modified discloses the web page as recited in claim 24, Bal as 
modified further discloses the web page comprising the executable control object (Bal: column 1 
line 19 - column 3 line 19). 
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41. As per claim 32, Bal discloses computer-readable medium, comprising 
computer-executable instructions that, when executed on a computer, perform the following: 
authenticating a web page that invokes the control object (Bal: column 7 lines 29-52); and 
executing a data-handling task on the computer if the web page is determined to be authentic 
(Bal: column 7 lines 29-52). Bal does not explicitly disclose a control object that performs the 
security functions. However, Renaud discloses that limitation (Renaud: column 4 lines 15-18). It 
is well known in the art to use control objects to perform security functions. Therefore, it would 
have been obvious to one having ordinary skill in the art to combine the teachings of Renaud 
within the system of Bal. 

42. As per claim 33, Bal as modified discloses the control object as recited in claim 32. Bal 
as modified further discloses wherein the web page is authenticated utilizing a digital signature 
attached to the web page (Bal: column 7 lines 29-52). 

43. As per claim 34, Bal discloses the control object as recited in claim 32. Bal further 
discloses instructions to determine if a source of the web page is authorized to invoke the 
data-handling task prior to executing the data-handling task (Bal: column 7 lines 29-51). 

44. As per claim 35, Bal discloses modulated data signal having data fields encoded thereon 
transmitted over a communication channel (Bal: column 7 lines 29-51: sending web page along 
with digital signature). Bal does not explicitly disclose a first data field containing data 
representing a web page and a second data field containing data representing a digital signature 



Application/Control Number: 09/650,712 Page 13 

Art Unit: 2131 

derived from the web page represented by the first data field. However, Renaud discloses having 
data fields and a signature field (Renaud: figure 3 and column 6 lines 46-65). Therefore, it would 
have been obvious to one having ordinary skill in the art to combine the teachings of Renaud 
within the system of Bal because it allows a system to authenticate the digital signature before 
accessing the digital data or control objects. 

45. Claim 25 is rejected under 35 U.S.C. 103(a) as being unpatentable over Bal in view of 
Renaud and further in view of Yoshiura. 

46. As per claim 25, Bal as modified discloses the web page as recited in claim 24. Bal as 
modified does not explicitly disclose wherein the digital signature is appended to the contents of 
the web page. However, Yoshiura discloses that limitation (Yoshiura: column 30 lines 43-55). It 
is well known in the art to append digital signature onto a data content. Therefore, it would have 
been obvious to one having ordinary skill in the art to combine the teachings of Yoshiura within 
the combination of Bal-Renaud. 

47. Claims 27-31 are rejected under 35 U.S.C. 103(a) as being unpatentable over Bal in view 
of Liu. 

48. As per claim 27, Bal discloses a web browser contained on a computer-readable medium 
of a client computer, comprising computer-executable instructions that, when executed by the 
client computer, perform the following: authenticating the web page using a digital signature 
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(Bal: column 1 line 19 - column 3 line 19 and column 7 lines 26-51); and invoking the control 
object if the source of the web page is authenticated (Bal: column 1 line 19 - column 3 line 19). 
Bal does not explicitly disclose determining if a web page contains instructions to invoke a 
control object. However, Liu discloses that limitation (Liu: column 8 lines 1-50). It would have 
been obvious to one having ordinary skill in the art to combine the teachings of Liu within the 
system of Bal because it increases efficiency by avoiding unnecessary further process. 

49. As per claim 28, Bal as modified discloses the web browser as recited in claim 27. Bal as 
modified further disclose determining if the web page contains executable script to invoke a 
control object (Liu: column 8 lines 1-50); and wherein the authenticating the web page further 
comprises authenticating the web page only if the web page contains executable script to invoke 
a control object (Liu: column 8 lines 1-50). Same rationale applies here as above in rejecting 
claim 43. 

50. As per claim 29 and 30, Bal as modified discloses the web browser as recited in claim 27. 
Bal as modified further discloses determining if the web page contains control software (Liu: 
column 8 lines 1-50) and require all controls to have digital signature for authentication (Bal: 
column 3 lines 7-19); and wherein the authenticating the web page further comprises 
authenticating the web page only if the web page contains a digital signature (Bal: column 7 lines 
32-38). Bal as modified indirectly disclose determining if the web page contains a digital 
signature. 
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51. As per claim 31, Bal as modified discloses the web browser as recited in claim 27. Bal as 
modified further discloses instructions to determine if an authenticated web page comes from a 
source that is authorized to invoke the control object (Bal: column 7 lines 29-51). 



Conclusion 

52. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

Parthasarathy et al. U.S. Pat. No. 6347398 discloses automatic software downloading 
from a computer network. 

Golan U.S. Pat. No. 5974549 discloses creating a secure sandbox within which a plurality 
of downloaded software components can execute in a secure manner. 

Flynn et al. U.S. Pat. No. 6567918 discloses saved web page security system and method. 

Brim U.S. Pat. No. 5835914 discloses method for preserving and reusing software objects 
associated with web pages. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Shin-Hon Chen whose telephone number is (703) 305-8654. The 
examiner can normally be reached on Monday through Friday 8:00am to 4:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (703) 305-9648. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 



# 



Application/Control Number: 09/650,712 



Page 16 



Art Unit: 2131 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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